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MEMORANDUM  FOR  DIRECTOR,  DEFENSE  FINANCE  AND  ACCOUNTING 

SERVICE  CLEVELAND  CENTER 


SUBJECT:  Audit  R^ort  on  Year  2000  Initiatives  at  the  Defense  Finance  and 
Accounting  Service  Cleveland  Center  (Report  No.  98-111) 


We  are  providing  this  audit  report  for  information  and  use.  This  is  the  first  in  a 
series  of  reports  on  Year  2000  initiatives.  The  primapr  purpose  is  to  identify  are^  of 
concern  related  to  Year  2000  efforts  at  the  Defense  Finance  and  Accounting  Service. 

We  considered  management  comments  on  a  draft  of  this  report  when  preparing 
the  final  report.  The  Defense  Finance  and  Accounting  Service  comments  comormed  to 
the  requirements  of  DoD  Directive  7650.3;  therefore  additional  comments  are  not 
required. 

We  appreciate  the  courtesies  extended  to  the  audit  staff.  Questions  on  the  audit 
should  be  directed  to  Ms.  Kimberley  Cs^rio,  Audit  Program  Director,  at 
(703)  604-9139  (DSN  664-9139),  e-maU  kcaprio@dodig.osd.mil,  or 
Mr.  Geoffi'ey  Weber,  Acting  Audit  Project  Manager,  at  (703)  604-9151 
(DSN  664-9151),  e-mail  gweber@dodig.osd.niil.  See  Appendix  E  for  the  report 
distribution.  The  audit  team  members  are  listed  inside  the  back  cover. 


Robert  J.  Lieberman 
Assistant  Inspector  General 
for  Auditing 


Office  of  the  Inspector  General,  DoD 


Report  No.  April  16, 1998 

(Project  No.  7FG-0043) 

Year  2000  InitiatiTes  at  the 
Defense  Finance  and  Accounting  Service 
Cleveland  Center 


Executive  Sununary 


Introduction.  This  is  one  in  a  series  of  r^rts  being  issued  by  the  Inspector  General, 
DoD,  in  an  informal  partnership  with  the  Chief  Information  Officer,  DoD,  to  monitor 
DoD  efforts  to  address  the  Year  2000  computing  challenge. 

Information  technology  systems  have  typically  used  two  digits  to  represent  the  year, 
such  as  “97”  representing  1997,  to  conserve  electronic  data  storage  and  reduce 
operating  costs.  With  the  two-digit  format,  the  Year  20(X)  would  be  represented  as 
“00,”  thus  mailing  it  indistinguishable  from  1900.  As  a  result  of  this  ambiguity, 
computers  and  associated  systems  and  application  programs  that  use  dates  to  calculate, 
compare,  and  sort  information  could  generate  incorrect  results  when  working  with 
years  Bftei  1999.  To  track  and  assess  die  progress  in  addressing  Year  20(X)  problems, 
DoD  issued  the  Y2K  Management  Plan.  The  Y2K  Management  Plan,  which  provides 
the  overall  strategy  for  resolving  issues,  has  five  phases:  awareness,  assessment, 
renovation,  valmtion,  and  implementation. 

Audit  Objectives.  The  overall  audit  objective  was  to  determine  the  effectiveness  of 
Defense  Finance  and  Accounting  Service  (DFAS)  initiatives  to  address  the  Year  2000 
computer  problem,  beginning  with  the  assessment  phase.  Specifically,  we  determined 
whether  the  DFAS  Cleveland  Center  performed  adequate  system  assessments,  and  we 
evaluated  the  existence  and  adequacy  of  interface  agreements.  Subsequent  reports  will 
address  the  other  DFAS  centers.  We  did  not  review  the  management  control  program 
as  it  relates  to  the  overall  audit  objective.  DFAS  and  DoD  identified  Year  2000  as  an 
uncorrected  material  weakness  in  their  Annual  Statements  of  Assurance  for  FYs  1996 
and  1997. 

Audit  Results.  To  assist  DFAS  in  talcing  prompt  action,  we  briefed  management  on 
issues  regarding  DFAS  reporting  requirements  and  interface  agreements.  DFAS  has 
initiated  actions  to  address  these  issues,  but  additional  efforts  are  needed.  DFAS 
Cleveland  Center  system  managers  have  not  performed  adequate  assessments  before 
moving  systems  into  the  renovation  phase.  One  DFAS  Cleveland  Center  system  has 
been  reported  as  Year  2000  compliant,  although  its  compliance  has  not  been  validated. 
The  DFAS  Cleveland  Center  has  not  established  all  interface  agreements  and  has  not 
obtained  interface  agreements  with  sufficiently  detailed  information  to  ensure  that 
interfaces  will  not  cause  failures  due  to  the  Year  20(X)  computing  problem. 

Summary  of  Recommendations.  We  recommend  that  the  DFAS  Cleveland  Center 
review  the  results  of  the  assessment  phase  at  the  system  level  to  ensure  that  proper 
assessments  have  been  performed;  validate  systems  identified  as  Year  20(X)  compliant; 
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establish  adequate  interface  agreements;  and  establish  verification  processes  to  ensure 
that  interface  agreements  meet  requirements  and  that  the  reporting  of  the  systems’ 
progress  in  becoming  Year  2000  compliant  reflects  actual  progress. 

Management  Comments.  The  DFAS  concurred  with  the  fmdings  and 
recommendations  in  the  draft  report.  The  DFAS  Cleveland  Center  stated  system 
managers  will  be  directed  to  complete  the  assessment  phase  exit  criteria  for  systems 
reporting  in  the  renovation  phase.  System  managers  will  also  be  required  to  complete 
the  compliance  certification  checklist  before  reporting  systems  as  compliant.  The 
Director,  DFAS  Cleveland  Center  will  conduct  mon^y  Y2K  Control  Board  meeti^s 
to  monitor  system  progress  and  to  provide  a  forum  for  prompt  resolution  of  potential 
problems.  In  addition,  the  DFAS  Cleveland  Center  established  a  milestone  of 
March  31,  1998,  to  correct  deficiencies  identified  with  Year  2000  interface  a^eements. 
System  managers  wUl  also  review  verification  procedures  to  ensure  that  existing 
interface  agreements  include  the  necessary  elements.  See  Part  I  for  a  discussion  of 
management  comments  and  Part  III  for  the  fiiU  text  of  management  comments. 
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Audit  Background 


The  Defense  Finance  and  Accounting  Service  (DFAS)  has  management 
responsibility  for  DoD  fiance  and  accounting  functions  and  the  information 
technology  used  to  perform  these  functions.  Each  year,  DFAS  pays 
approximately  4  million  military  and  civilian  personnel,  2  million  retirees  and 
annuitants,  and  23  million  invoices  to  contractors  and  vendors.  DFAS 
Year  2000  (Y2K)  quarterly  reports  track  196  systems.  Of  these,  the  DFAS 
Cleveland  Center  reports  on  76  systems.  Because  DFAS  relies  heavily  on 
computer  systems  to  carry  out  its  operations,  Y2K  issues  can  affect  every  aspect 
of  the  DFAS  finance  and  accounting  mission. 

The  cause  of  the  Y2K  problem  is  that  automated  systems  typically  use  two  digits 
to  represent  the  year,  such  as  “97”  to  represent  1997,  to  conserve  electronic 
data  storage  and  reduce  operating  costs.  With  the  two-digit  format,  however, 
the  Y2K  is  indistinguishable  from  1900.  As  a  result  of  t&  ambiguity, 
computers  and  associated  systems  and  application  programs  that  use  ^tes  to 
calculate,  compare,  and  sort  information  could  generate  incorrect  results  when 
working  with  years  after  1999.  The  calculation  of  Y2K  dates  is  further 
complicated  because  Y2K  is  a  leap  year.  Computer  systems  and  applications 
must  recognize  February  29,  2000,  as  a  valid  date.  Unless  the  problem  is 
corrected,  those  automated  systems  will  fail.  Therefore,  senior  management 
must  monitor  progress  closely.  To  maintain  awareness  of  potential  areas  of 
concern,  both  the  Office  of  Management  and  Budget  (ONffl)  and  DoD  require 
that  the  status  of  Y2K  compliance  be  reported  frequendy. 

Because  of  the  potential  qperational  impact  on  Government  computers,  the 
General  Accounting  Office  (GAO)  identified  Y2K  as  a  high-risk  program.  DoD 
and  DFAS  also  identified  Y2K  as  an  uncorrected  material  weakness  in  their 
Annual  Statements  of  Assurance  for  FYs  1996  and  1997. 

0MB  Reporting  Requirements.  On  February  6,  1997,  0MB  issued  a  report, 
“Getting  Federal  Computers  Ready  for  2000.”  The  0MB  rqport  included  an 
initial  cost  estimate,  planned  strategy,  and  a  timetable  for  implementing  the 
planned  strategy.  In  addition,  OMDB  will  monitor  agency  progress  by  requiring 
quarterly  reports.  On  May  7,  1997,  0MB  issued  the  “Memorandum  on 
Computer  Difficulties  Due  to  the  Y2K  —  Progress  Rqiorts.”  The  memorandum 
requires  that  Y2K  progress  reports  be  issued  to  Congress  and  the  public.  The 
heads  of  selected  (^vemment  agencies  must  report  on  the  status  of  Y2K  efforts 
each  quarter,  with  the  initial  report  due  on  May  IS,  1997.  Each  agency  is 
required  to  report  on  mission-critical  systems,  including  the  number  of  systems 
that  are  Y2K  compliant,  being  replaced  and  repaired,  and  scheduled  to  be 
retired. 

DoD  Reporting  Requirements.  As  the  DoD  Chief  Information  Officer  (CIO), 
the  Assistant  Secretary  of  Defense  (Command,  Control,  Communications  and 
Intelligence)  (ASD  [C3I])  issued  a  memorandum  on  March  12,  1997,  “Y2K 
Refin^  Reporting  Requirements  for  DoD.”  The  memorandum  establishes 
quarterly  reporting  requirements  for  Y2K  assessment  and  progress  throughout 
DoD.  Reports  are  intended  to  show  the  status  of  DoD  Y2K  efforts  and  are  used 
by  the  CIO  to  oversee  DoD  Y2K  efforts  and  fulfill  0MB  reporting  requirements 
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at  the  DoD  level.  The  memorandum,  which  also  established  oriteria  for 
reporting  mission-critical  systems  in  the  Defense  Integration  Support  Tools 
(DISI}  database,  is  published  as  an  appendix  to  the  DoD  Y2K  Management 
Plan. 

DoD  Y2K  Management  Plan  (Version  1.0,  April  1997).  The  DoD  Y2K 
Management  Plan  provides  the  overall  DoD  strategy  and  guidance  for  taking 
inventory,  prioritizing,  fixing  and  retiring  systems,  and  monitoring  progress  in 
resolving  Y2K  issues.  Each  DoD  Component  is  responsible  for  awareness, 
assessment,  renovation,  validation,  and  implementation  action. 

The  flve-Ptaase  Management  Process.  Each  of  the  five  phases  listed 
below  represents  a  major  Y2K  program  activity  or  segment.  Target  completion 
dates  range  from  December  1996  &ough  March  1,  1999. 

•  Phase  I  -  Awareness.  Define  the  Y2K  problem  and  gain 
executive-level  support  and  sponsorship.  Establish  a  Y2K  program  tem  and 
develop  an  overall  strategy.  Ensure  that  everyone  in  the  organization  is  fully 
aware  of  the  Y2K  problem.  Target  completion  date:  December  1996. 

•  Phase  II  -  Assessment.  Assess  the  impact  of  Y2K  on  the  enterprise. 
Identify  core  business  areas  and  processes,  take  inventory,  and  analyze  systems 
that  support  the  core  business  areas,  prioritize  dieir  conversion  or  replacement. 
Develc^  contingency  plans  to  handle  data  exchange  issues,  lack  of  data,  and  bad 
data.  Identify  and  secure  the  necessary  resources.  Target  completion  date:  June 
1997. 


•  Phase  III  -  Renovation.  Convert,  replace,  or  eliminate  selected 
platforms,  applications,  databases,  and  utilities.  Modify  interfaces.  Target 
completion  ^te:  September  1998. 

•  Phase  IV  -  Validation.  Test,  verily,  and  validate  converted  or 
r^laced  platforms,  t^plications,  dat^ases,  and  utilities.  In  an  operational 
environment,  test  die  performance,  functionality,  and  integration  of  converted 
or  replaced  platforms,  applications,  databases,  utilities,  and  interfaces.  Target 
completion  date:  January  1999. 

•  Phase  V  -  Implementation.  Implement  converted  or  replaced 
platforms,  {^plications,  databases,  utilities,  and  interfaces.  If  necessary, 
implement  contingency  plans  for  ^ta  exctmge.  Target  completion  date: 

March  1,  1^9. 

DIST  Database.  The  DIST  database,  maintained  by  the  Defense 
Information  Systems  Agency,  contains  data  on  cert{Uin  automated  systems  used 
by  DoD  Components,  including  data  on  hardware  platforms,  operating  systems, 
application  Umgu^es,  communications,  and  interfaces.  The  DIST  database 
provided  DoD-wide  information  on  Y2K  that  managers  could  use  to  track  and 
monitor  Y2K  compliance  for  mission-critical  tuid  odier  designated  syste^.  The 
ASD  (C3I)  is  eiqiected  to  update  the  DoD  Y2K  Management  Plan  and  direct  a 
different  data  repository  arrangement. 
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DFAS  Y2K  Executiye  Plan.  To  ensure  that  all  active  DFAS  systems  are  Y2K 
compliant,  DFAS  developed  a  Y2K  Executive  Plan  that  outlines  management 
responsibilities  and  reporting  requirements.  The  DoD  Y2K  Management  Plan 
covers  the  following  four  gener^  areas  to  ensure  that  DFAS  meets  the 
challenge.  The  plan  covers  the: 

•  establishment  of  the  DFAS  Y2K  points  of  contact  (POCs)  at  various 
levels  within  the  organization,  including  a  POC  who  participates  in  the  DoD 
Y2K  Working  Group  and  distributes  Y2K  information  to  DFAS. 

•  establishment  of  an  inventory  of  DFAS  systems  that  categorizes 
systems  to  be  changed,  replaced,  or  terminated  and  those  that  are  Y2K 
compliant. 

•  establishment  of  Y2K  responsibilities  for  the  program  and  system 
managers;  Directors  of  the  DFAS  Centers;  the  Deputy  Director,  DFAS;  and  the 
Deputy  Director  for  Information  Management. 

•  develq)ment  of  a  DFAS  quarterly  consolidated  report  with 
information  on  systems  at  the  DFAS  Centers  and  Deputates. 


Audit  Objective 


The  overall  audit  objective  was  to  determine  the  effectiveness  of  DFAS 
initiatives  to  address  the  Y2K  computer  problem,  beginning  with  the  assessment 
phase.  Specifically,  we  determined  whether  the  DFAS  Cleveland  Center  had 
performed  adequate  system  assessments,  and  we  evaluated  the  mustence  and 
adequacy  of  interface  agreements.  Subsequent  reports  will  address  the  other 
DFAS  Centers.  We  did  not  review  the  management  control  progr^  as  it 
relates  to  the  overall  audit  objective  because  DFAS  and  DoD  identified  Y2K  as 
an  uncorrected  material  wealmess  in  their  Annual  Statements  of  Assurance  for 
FYs  1996  and  1991.  See  Appendix  A  for  a  discussion  of  the  audit  scope  and 
mediodology. 


Other  Matters  of  Interest 

Determining  whether  systems  are  Y2K  compliant  is  a  relatively  new 
requirement  for  DFAS  system  managers.  The  objectives  of  thiis  audit  focused 
on  Y2K  compliance  issues  and  did  not  include  evduating  the  software 
maintenance  processes  of  the  DFAS  Cleveland  Center  and  its  Financial  Systems 
Activity.  However,  during  our  audit  work,  we  encountered  areas  of  concern 
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relating  to  the  processes  used  by  system  managers  to  ensure  that  their  systems 
are  Y2K  compliant.  Based  on  interviews  with  system  mamgers  and 
documentation  supporting  Y2K  system  changes,  it  was  evident  that  practices  and 
procedures  were  not  consistently  applied  to  3ie  system  change  processes  for 
Y2K  requirements. 

The  capability  maturity  model  (CMM)  was  established  by  the  Software 
Engineering  Institute  at  Carnegie  Mellon  University,  Pittsburgh,  Pei^ylvania, 
to  measure  the  level  of  software  maintenance  organizations.  According  to  the 
CMM,  organizations  ^t  are  ranked  at  higher  levels  have  a  lower  risk  of  cost 
overruns  and  schedule  delays  when  performing  software  maintenance  projects. 
We  did  not  evaluate  the  DFAS  organizations  ^t  performed  Y2K  software 
maintenance  against  ^e  standards  in  the  CMM.  However,  we  encountered 
characteristics  typically  attributed  to  lower-ranked  software  development 
organizations.  Specifically,  we  noted  a  lack  of  awareness  and  application  of 
existing  policies  and  proc^ures  for  software  maintenance.  We  also  reviewed 
Y2K  maintenance  project  plans  which  did  not  include  thorough  definitions  of 
the  work  required  and  realistic  milestones  based  on  estimated  work 
requirements. 
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Finding  A.  DFAS  Reporting 
Requirements 

The  DFAS  Cleveland  Center’s  quarterly  reports  on  Y2K  were  unreliable 
and  did  not  accurately  report  the  progress  in  solving  Y2K  problems  at 
the  DFAS  Cleveland  Center.  Sp^ifically,  the  DFAS  Cleveland  Center 
did  not: 

•  perform  adequate  assessments  of  systems  reported  in  the 
renovation  phase,  and 

•  meet  all  requirements  for  making  systems  Y2K  compliant. 

The  quarterly  rqmrts  were  unreliable  because  system  managers  at  the 
DFAS  Cleveland  Center  did  not  implement  the  requirements  of  the  DoD 
Y2K  Management  Plan,  which  specifies  the  exit  criteria  and  minimum 
requirements  for  a  system-level  Y2K  project  plan.  In  addition,  the 
DFAS  Cleveland  Center  did  not  have  a  mechanism  for  verifying  that  a 
system  had  met  the  requirements  for  progressing  from  one  phase  to  the 
next.  As  a  result,  DoD  and  DFAS  management  were  relying  on 
inaccurate  information,  which  increased  the  risk  of  system  failures  due 
to  Y2K  noncompliance. 


Y2K  Reporting  Requirements 

DFAS  Quarterly  Reporting  Requirements.  DFAS  reports  quarterly  on  the 
Y2K  status  of  all  its  systems.  The  quarterly  reporting  process  is  used  by  DoD 
and  DFAS  management  to  monitor  Y2K  progress  and  to  decide  where  to 
allocate  resources.  Each  DFAS  Center  prqiares  a  quarterly  report  summarizing 
the  status  of  its  assigned  systems.  The  quarterly  reports  are  updated,  then 
reviewed  and  approved  by  the  Director  of  a  DFAS  Center  or  the  Deputy 
Director,  DFAS,  and  are  submitted  to  the  DFAS  Y2K  Project  Manager,  who 
consolidates  the  data  into  a  single  report.  The  consolidated  rqiort,  a  summary- 
level  report  that  tracks  progress  at  the  DFAS  level,  is  reviewed  by  the  Deputy 
Director  for  Information  Management.  Subsequently,  the  Deputy  Director  for 
Information  Ma^ement  issues  a  less  comprehensive  Y2K  quarterly  report  to 
ASD  (C3I)  for  inclusion  in  the  DoD  consolidated  Y2K  quarterly  report  to 
0MB. 

To  identify  and  monitor  the  status  of  all  DoD  systems  in  becoming  Y2K 
compliant,  the  ASD  (C3I)  and  DFAS  have  established  reporting  guidelines. 

The  guidance  standardizes  the  reporting  process  and  ensures  that  system 
managers  use  a  consistent  methodology  for  reporting  the  Y2K  status  of  systems. 

DoD  Guidance.  The  DoD  Y2K  Management  Plan,  Version  1.0,  April  1997, 
details  the  five-phase  management  process,  key  responsibilities  of  DoD 
Components,  quarterly  reporting  requirements,  and  the  timeline  for  completion 
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of  each  Y2K  phase.  The  DoD  Y2K  Management  Plan  also  gives  criteria  for 
DoD  Components  to  determine  the  apprc^riate  Y2K  phase  for  each  system  in 
their  quarterly  Y2K  reports  to  the  ASD  (C3I). 

DFAS  Guidance.  DFAS  Regulation  8000. 1>R,  “Information  Management 
Policy  and  Instructional  Guidance,”  version  5,  chjq)ter  11,  Y2K  Initiative, 

June  19,  1997,  establishes  DFAS  Y2K  guidance,  corporate  strategy,  and  a 
DFAS  Executive  Plan  for  Year  2000.  The  Regulation  also  defines  the  system 
release  test  procedures  and  processes  that  DF/^  system  managers  should  follow 
to  ensure  Y2K  compliance,  including  system  certification  gui^ce  and  a  DFAS 
compliance  certification  checklist. 


System  Phase  Quarterly  Reporting 

We  reviewed  selected  systems  rq)orted  by  the  DFAS  Cleveland  Center.  These 
systems  were  listed  in  the  DFAS  October  1997  quarterly  report  submitted  to  the 
Deputy  Director  for  Information  Management.  Systems  at  the  DFAS  Cleveland 
Center  were  reported  in  phases  that  did  not  accurately  reflect  die  level  of  work 
performed.  Specifically,  three  of  the  sbc  systems  we  reviewed  had  not 
completed  a  sufficiently  thorough  assessment  to  be  reported  in  the  renovation 
phase.  In  addition,  one  of  the  two  systems  that  we  reviewed  was  reported  as 
being  Y2K  compliant,  although  it  had  not  met  the  reporting  requirements. 

According  to  the  DoD  Y2K  Management  Plan,  each  DoD  Component  should 
complete  the  exit  criteria  for  each  phase,  and  systems  that  cannot  meet  DoD- 
established  completion  dates  should  be  tracked  to  ensure  that  exit  oriteria  are 
completed  by  the  last  day  of  each  phase.  The  system  managers  should  use  the 
exit  criteria  in  the  DoD  Y2K  Management  Plan  to  determine  whether  a  system 
has  completed  an  adequate  assessment  and  can  proceed  to  the  next  Y2K  phase. 
System  managers  should  perform  these  basic  steps  before  applying  the  exit 
criteria  to  DFAS  as  a  whole. 


Systems  Reported  in  the  Renovation  Phase 

In  the  DFAS  October  1997  quarterly  report,  the  DFAS  Cleveland  Center 
reported  20  of  76  systems  in  the  “to  be  chafed”  category.  All  20  systems 
were  also  rq>orted  in  the  renovation  phase.  (The  remaining  56  systems  were 
categorized  as  “to  be  replaced,”  “bemg  develcped  as  Y2K  compliant,”  or 
“already  Y2K  compliant.  ”)  To  report  that  a  system  is  in  the  renovation  phase, 
the  system  should  meet  the  exit  criteria  of  the  assessment  phase  as  outlined  in 
the  DoD  Y2K  Management  Plan.  Developing  a  system-level  Y2K  project  plan 
is  the  primary  deliverable  for  exiting  the  assessment  phase. 

Requirements  for  Cmnpleting  fhe  Assessment  Phase.  During  the  assessment 
phase,  the  system  manager  determines  the  level  of  Y2K  work  to  be  performed, 
develops  an  initial  cost  estimate,  and  prepares  a  detailed  Y2K  project  plan.  For 
a  DoD  system  to  advance  from  the  assessment  phase,  the  DoD  Y2K 
Management  Plan  requires  that  the  following  exit  criteria  be  completed: 
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•  an  assessment  phase  plan, 

•  a  documented  renovation  strategy, 

•  a  Y2K  resource  strategy  and  plan, 

•  a  documented  validation  strategy, 

•  inclusion  of  the  system  in  the  DIST  database,  and 

•  a  documented  plan  for  risk  management  and  contingencies. 

To  exit  the  assessment  phase,  each  DoD  Component  should  have  a  documented 
Y2K  project  plan  for  each  system.  A  Y2K  project  plan  incorporates  the 
elements  of  the  assessment  phase  exit  criteria  listed  above,  and,  in  accordance 
with  the  DoD  Y2K  Management  Plan,  should  include,  at  a  minimum: 

•  the  start  and  release  date  for  each  phase, 

•  major  st^s  in  conversion  (renovation)  and  testing  (validation)  of  the 
code, 

•  major  steps  in  establishing  the  necessary  infrastructure,  and 

•  resources  required  to  accomplish  these  tasks. 

A  comprehensive  Y2K  project  plan  can  minimize  costs  arid  shifting  of 
resources,  establishes  accurate  schedules  and  milestones,  identifies  deficiencies, 
and  lessens  risks  as  a  system  progresses  through  the  Y2K  phases.  Without  an 
adequate  assessment  and  a  detailed  Y2K  project  plan,  system  managem  may 
underestimate  the  work  and  resources  required  to  make  a  system  Y2K 
compliant.  Performing  an  adequate  assessment  and  d^eloping  a  detailed 
project  plan  allows  system  managers  to  develop  realistic  and  accurate  milestones 
and  increases  the  probability  of  meeting  the  milestones. 

Completion  of  the  Assessment  Phase.  We  selected  6  of  the  20  systems 
reported  in  the  renovation  phase  to  determine  whether  the  systems  met  the 
requirements  for  completing  the  assessment  phase.  Our  analysis  was  based  on 
the  exit  criteria  and  minimum  elements  of  a  project  plan  at  the  coE^letion  of  the 
assessment  phase.  We  did  not  review  the  assessment  phase  exit  criteria  in  the 
DoD  Y2K  Management  Plan  for  establishing  risk  management  and  contingency 
plans.  For  three  of  the  six  systems  reviewed,  system  managers  at  the  DFAS 
Cleveland  Center  had  not  performed  an  adequate  assessment  and  had  not  met  all 
of  the  exit  criteria  for  the  assessment  phase.  The  following  are  two  examples  of 
systems  inappropriately  reported  in  the  renovation  phase. 

Automated  Disbursing  System  (ADS).  ADS  is  an  interim  migratory 
system  identified  by  DFAS  as  one  of  its  top  20  mission-critical  systems.  ADS 
produces  vouchers  for  disbursements  and  collections,  issues  payments,  processes 
returned  payments,  prepares  Forms  W-2  (Wage  and  Tax  Statements),  and 
reports  accounting  information.  The  October  19S)7  quarterly  report  showed 
ADS  in  the  renovation  phase.  At  that  time,  system  managers  had  identified  the 
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system  in  the  DIST  database,  had  established  start  and  release  dates  for  each 
phase,  and  had  developed  a  Y2K  resource  strategy  and  plan.  However,  system 
managers  had  not; 

•  documented  the  renovation  strategy, 

•  documented  the  validation  strategy,  and 

•  documented  the  major  steps  in  establishing  the  necessary 
infrastructure. 

Book  Entry  Bond  System  (BEBS).  BEBS  provides  electronic 
safekeeping  of  bonds  purchased  by  an  active  duty  member  until  the  member 
requests  that  the  bonds  be  mailed  to  an  address.  This  system  was  reported  in 
the  renovation  phase  in  the  October  1997  quarterly  report.  At  that  time,  system 
managers  had  identified  the  system  in  DIST  and  had  identified  start  and  release 
dates  for  each  phase.  However,  system  managers  had  not: 

•  identified  the  resources  required, 

•  documented  the  renovation  strategy, 

•  documented  the  validation  strategy,  and 

•  documented  the  major  steps  in  establishing  the  necessary 
infrastructure. 

Inaccurate  Reporting  of  Systems  in  the  Renovation  Phase.  Of  the  six 
systems  we  reviewed  at  the  DFAS  Cleveland  Center,  three  had  not  met  all  exit 
criteria  for  the  assessment  phase  to  permit  them  to  be  rqiorted  in  the  renovation 
phase.  This  occurred  because  system  managers  did  not  follow  die  reporting 
guidance  in  the  DoD  Y2K  Management  Plan  and  had  not  adequately  assessed 
the  work  required  to  make  the  system  Y2K  compliant. 

Impact  of  Incomplete  Exit  Criteria  and  Project  Plans  Before  Completing 
the  Assessment  Hiase.  Inaccurate  reporting  of  DFAS  systems  could  adversely 
affect  the  conversion  of  systems  to  meet  the  Y2K  deadline.  DoD  has 
established  guidelines  and  exit  criteria  for  the  five  phases  to  ensure  consistency 
in  the  reporting  process  and  provide  baselines  against  which  to  assess  progress 
in  meeti^  Y2K  compliance.  Regardless  of  the  phase  in  which  a  DFAS  system 
is  r^orted,  the  st^s  oudined  in  die  exit  criteria  must  be  performed  in  a  timely 
manner.  Ihe  exit  criteria  give  system  managers  a  method  for  achieving  Y2K 
conqiliance.  This  is  particularly  important  for  die  88  systems  that  DFAS,  in 
total,  has  identified  as  mission-crid^.  Delay  or  failure  to  complete  the  steps  in 
the  exit  criteria  for  each  phase  could  result  in  systems  that  are  not  Y2K 
compliant  and  potential  system  Mures  when  processing  Y2K  data.  In  addition, 
organizations  outside  DFAS,  including  the  ASD  (C3I)  and  0MB,  rely  on  the 
quarterly  rqiorts  to  be  consistent  and  accurate.  A^en  DFAS  systems  are 
reported  as  being  in  the  renovation  phase  without  completing  the  exit  criteria  for 
the  assessment  phase,  this  gives  0MB  and  DoD  an  inaccurate  view  of  work 
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performed.  DFAS  system  managers  should  meet  the  assessment  phase  exit 
criteria  in  the  DoD  Y2K  management  plan  for  systems  reported  in  the 
renovation  phase. 


Systems  Reported  as  Compliant 

In  the  October  1997  quarterly  report,  8  of  the  76  systems  reported  under  the 
DFAS  Cleveland  Center  were  Y2K  compliant.  Several  processes  can  be 
followed  to  make  a  system  Y2K  comi)liant.  A  system  can  be  developed  as  Y2K 
compliant  and  coni^med  by  certification;  or  an  existing  system  can  be  made 
compliant  through  the  five-phase  process  and  con^rmed  in  the  validation  phase. 
However,  before  rq)orting  a  system  as  compliant,  the  system  must  go  through 
the  certification  process.  We  reviewed  two  of  the  eight  systems  that  the  DFAS 
Cleveland  Center  reported  as  Y2K  compliant.  The  two  systems  were  the 
Defense  Working  Capital  Accounting  System  (DWAS)  and  the  Uniform 
Microcomputer  Disbursing  System  (UMIDS). 

Requirements  for  Completing  the  Validation  Phase.  In  the  validation  phase, 
assorted  testing  and  compliance  processes  are  used  to  provide  assurance  t^t 
systems  are  Y2K  compliant.  For  a  system  to  exit  the  validation  phase  and  be 
certified  as  Y2K  compliant,  die  following  criteria,  as  identified  in  the  DoD  Y2K 
Management  Plan,  should  be  completed  and  documented: 

•  unit,  integration,  and  system  testing  and  system  certified  and 

•  acceptance  testing  and  system  certification. 

Certification  Process.  DFAS  Regulation  8000. 1-R  gives  system 
managers  guidance  on  Y2K  system  certification,  including  a  compliance 
certification  checldist  and  test  procedures  for  determining  Y2K  system 
compliance.  The  Regulation  requires  unit  testing,  integration  testing,  accqptance 
testing,  and  independent  third  party  testing.  DFAS  system  managers,  in 
coordination  with  the  technical  manager,  are  to  conqilete  the  cotification 
checklist  and  return  it  to  the  Y2K  POC.  The  PCX  is  to  review  the  completed 
checklist  and  verify  any  incomplete,  inconsistent,  or  confusing  information  with 
the  system  manager.  Subsequendy,  the  DFAS  Center  Director  or  the  Deputy 
Director,  DFAS,  is  to  review  and  sign  the  completed  checklist.  The  Director, 
DFAS  Cleveland  Center,  meets  with  system  managers  to  joindy  review  the 
cer^cation  checldist. 

Meeting  Criteria  for  Compliance.  We  reviewed  two  of  the  eight 
systems  that  die  DFAS  Cleveland  Center  reported  as  Y2K  coll^)liant.  We 
determined  that  one  of  those  systems,  DWAS,  had  not  met  the  exit  criteria  and 
should  not  have  been  reported  as  Y2K  compliant.  Our  analysis  was  based  on 
the  exit  criteria  for  the  validation  phase.  Specifically,  DWAS  did  not  meet  the 
exit  criteria  but  was  rqioned  as  compliant  in  the  DFAS  October  1997  quarterly 
report.  DWAS  is  a  migratory  system  identified  by  DFAS  as  1  of  the  top 
20  mission-critical  systems.  It  is  designed  to  account  for  transactions  from  two 
component  business  areas.  At  the  time  of  our  review,  DWAS  system  managers 
reported  that  neither  of  the  DWAS  components  had  performed  sdl  of  the  testing 
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required  by  the  DoD  Y2K  Management  Plan  to  report  a  system  as  compliant. 
Therefore,  this  system  should  not  have  been  reported  as  Y2K  compliant  in  the 
October  1997  quarterly  report. 

Inaccurate  Reporting  of  DWAS  as  Compliant.  DWAS  was  erroneously 
reported  as  compliant  for  the  following  reasons. 

•  System  managers  did  not  follow  all  guidance  in  the  DoD  Y2K 
Management  Plan  for  completing  the  exit  criteria  for  the  validation 
phase  before  reporting  the  system  as  Y2K  con:q>liant. 

•  The  DFAS  Cleveland  Center  lacked  a  mechanism  for  verifying  that 
all  requirements  were  performed  and  documented  before  reporting 
systems  as  Y2K  compuant. 

•  System  managers  perceived  a  need  to  demonstrate  progress  in 
reporting  systems  as  Y2K  conpliant. 

Guidance  in  the  DoD  Y2K  Management  Plan.  As  stated  above, 
DWAS  system  managers  did  not  follow  the  DoD  Y2K  Management  Plan  exit 
criteria  requirements  before  rqxjrting  DWAS  as  Y2K  compliant.  DFAS 
Cleveland  Center  system  managers  n^  to  ensure  that  the  DoD  Y2K 
Management  Plan  exit  oiteria  are  completed  before  reporting  systems  as 
compliant. 

Mechanism  for  Verification.  The  DFAS  Cleveland  Center  lacked  a 
method  for  verifying  that  system  managers  completely  and  accurately  rqmrt  the 
work  performed  to  achieve  system  Y2K  complian^.  DF^  was  relying  on 
system  managers  to  report  complete  and  accurate  information  for  consolidation 
into  quarterly  rqwrts  used  by  both  internal  users  and  outside  organizations. 
However,  it  needs  to  establish  a  mechanism  to  ensure  that  systems  are 
progressing  as  needed  to  meet  Y2K  deadlines  and  that  information  reported  to 
DoD  and  DFAS  management  is  accurate,  reliable,  and  reflects  the  status  of  each 
DFAS  system. 

Percdlyed  Need  to  Report  Prepress.  Based  on  our  interviews,  DFAS 
Cleveland  Center  personnel  perceived  the  need  to  become  Y2K  compliant  as 
soon  as  possible  and  to  report  significant  progress.  Managers  do  not  want  to 
fall  behind  and  be  reported  to  DFAS,  DoD,  and  other  organizations  as  not 
meeting  Y2K  goals.  Thus,  rather  than  reporting  conservatively,  managers  may 
be  optimistic  in  their  estimations  of  progress  on  Y2K  compliance. 

Impact  of  Inaccurate  Reporting.  Inaccurate  reporting  of  DFAS  systems, 
either  in  the  renovation  plmse  or  as  Y2K  compU^t,  could  have  adversely 
affected  both  DoD  and  DFAS.  DoD  and  DFAS  managers  relied  on  the 
information  and  made  assumptions  in  planning  future  Y2K  work;  as  a  result, 
systems  might  fail.  Y2K  compliance  testing  in  a  later  phase  mig^t  fiiil  to 
achieve  Y2K  compliancy  within  accqitable  time  frames.  Specifically,  if  DFAS 
managers  had  believed  ^t  systems  reported  in  the  renovation  phase  had 
completed  all  exit  criteria  for  the  assessment  phase,  they  may  have  assumed,  for 
example,  that  major  steps  required  to  convert  or  test  codes  had  been  determined 


11 


Finding  A.  DFAS  Reporting  Reciuirements 


and  that  required  resources  were  available.  Considering  the  potential  shortfall 
m  staffing  and  the  resources  needed  for  testing,  these  criteria  must  be  addressed 
as  soon  as  possible. 


Conclusion 

The  accuracy  of  quarterly  rqwrting  is  critical;  however,  the  actual  work 
performed  by  DFAS  is  more  important  in  solving  the  Y2K  problem.  DFAS 
should  be  concerned  that  its  system  makers  meet  all  minimum  requirements  in 
the  DoD  Y2K  Management  Plan  for  exit  criteria  and  project  plans.  More 
importantly,  DFAS  managers  should  ensure  that  an  adequate  assessment  of  each 
system  is  performed  in  a  meAodical,  effective,  and  efficient  manner.  Further, 
DFAS  and  DoD  management  will  not  have  accurate  and  reliable  information  on 
the  status  of  all  DFAS  systems  unless  the  methodology  in  the  DoD  Y2K 
Management  Plan  is  consistently  applied.  Otherwise,  DoD  and  DFAS 
management  could  possibly  rely  on  inaccurate  information  that  could  increase 
the  risk  of  system  hadlure  due  to  the  Y2K  problem. 


Recommendations,  Management  Comments,  and  Audit 
Response 

A.  We  recommend  that  the  Director,  Defense  Finance  and  Accounting 
Service  Cleveland  Center: 

1.  Direct  ^^ystem  managers  at  the  Defmse  Finance  and  Accounting 
Service  Cleveland  Center  to  fidfiU  tibe  assessment  phase  exit  criteria  in  the 
DoD  Year  2000  Management  Plan  for  systems  reported  as  beii%  in  the 
renovation  phase. 

Managonent  Comments.  The  DFAS  concurred,  stating  that  the  DFAS 
Cleveland  Center  system  managers  wUl  be  directed  to  complete  the  assessment 
phase  exit  criteria  for  systems  rqwrting  in  the  renovation  phase.  DFAS  further 
stated  that  DFAS  Regulation  8000. 1-R  documents  the  validation  strategy 
required  in  the  assessment  phase  exit  criteria. 

Audit  Response.  While  DFAS  Regulation  8000. 1-R  documents  the  corporate 
validation  process,  the  DoD  Y2K  Management  Plan  infers  that  the  validation 
strategy  results  from  an  assessment  of  the  individual  system  testing  requirements 
rather  than  a  validation  process  at  the  corporate  level.  The  action  taken  by 
Defense  Finance  and  Accounting  Service  has  met  the  intent  of  the 
recommendation. 
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2.  Direct  system  managers  at  the  Defense  Finance  and  Accorniting 
Service  Cleveland  Center  to  meet  all  criteria  in  the  DoD  Year  2000  ^ 
Management  Plan  for  systems  listed  as  Year  2000  compliant,  including 
completion  of  the  Defense  Finance  and  Accounting  Servira  compliance 
certification  checklist,  before  reporting  systems  as  compliant. 

Managonent  Comments.  The  DFAS  concurred,  stating  that  the  DF^ 
Cleveland  Center  system  managers  will  con^lete  the  compliance  certification 
checklist  before  reporting  systems  as  compliant. 

3.  Flstablish  a  verification  mechanism  to  ensure  that  systems  are 
progressing  as  needed  to  meet  the  deadline  and  that  information  reported 
to  DoD  and  Defense  Finance  and  Accounting  Service  management  is 
accurate,  refiable,  and  reflects  the  status  of  each  Defense  Finance  and 
AccountLog  Service  ^stem. 

Management  Comments.  The  DFAS  concurred,  stating  that  the  DFAS 
Cleveland  Center  Director  will  conduct  monthly  Y2K  Control  Board  matings 
to  provide  a  mechanism  for  monitoring  system  progress.  Tto  fonm  will 
provide  detailed  Year  2000  system  status  and  ensure  corrective  actions  should 
problems  arise. 
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The  DFAS  Cleveland  Center  had  not  effectively  completed  ^  necessary 
interface  agreements.  Of  the  152  interface  agreements  required  for  the  9 
DFAS  Cleveland  Center  systems  we  reviewed,  73  interface  ajpreements 
for  3  of  the  systems  had  not  been  established.  Of  the  remaining  79 
interface  agreements  that  were  established: 

•  54  did  not  identify  strategies  and  changed  record  formats, 

•  53  lacked  milestone  dates  for  implementation, 

•  51  did  not  identify  test  files,  and 

•  62  did  not  identify  a  POC. 

DFAS  identified  5  of  the  9  systems  reviewed  among  its  top  20  mission- 
critical  systems.  The  DFAS  Cleveland  Center  does  not  have  a 
verification  process  to  ensure  that  adequate  interface  agreements  are  in 
place.  As  a  result,  some  issues  --  such  as  identifying  responsible  parties 
and  determining  how  and  when  critical  data  exchanges  will  occur  --  may 
be  unclear  and  could  cause  a  system  to  operate  improperly. 


DFAS  Cleveland  Center’s  Responsibility  for  Systems 

According  to  the  October  1997  quarterly  rq)ort,  the  DFAS  Cleveland  Center  is 
tracking  76  finance  and  accounting  s^^stems.  Those  systems  are  primarily 
responsible  for  processing  and  rqwrting  on  retiree  pay  and  contractor  payments. 
For  systems  that  we  select^  for  review,  the  number  of  interfaces  with  other 
systems  ranged  from  2  to  53. 


Requirement  for  Interface  Agreements 

Successful  data  exchanges  are  essential  to  DFAS  finance  and  accounting 
operations.  DFAS  systems  interface  internally  with  other  DFAS  systems  and 
externally  with  systems  belonging  to  the  Services,  DoD  Components,  and 
various  Federal  agencies.  Data  exchanges  are  CTitical  in  the  Y2K  effort  because 
they  can  introduce  or  transmit  errors  from  one  organization  to  another. 

Interface  agreements  are  necessary  when  multiple  parties  are  involved  in  data 
exchanges.  The  DoD  Y2K  Management  Plan  recommends  that  an  interface 
agreement  be  a  Memorandum  of  Agreement  (MOA)  or  the  equivalent.  System 
owners  can  reduce  the  risk  of  potential  failure  by  establishing  interface 
agreements  and  agreeing  on  schedules  and  changed  record  formats  and 
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providing  one  another  with  test  files.  The  DFAS  Executive  Plan  for  Y2K 
malrfts  system  managers  responsible  for  agreeing  how  and  when  an  interface 
between  systems  will  be  Y2K  compliant. 

An  interface  agreement  negotiated  between  the  affected  parties  should  allow 
DFAS  to: 

•  identify  and  understand  the  strategy  that  each  system  and  interface 
will  use  for  Y2K; 

•  ensure  that  milestones  are  closely  coordinated,  monitored,  and 
accomplished  in  a  timely  manner; 

•  identify  testing  to  be  performed  for  each  system  involved  with  the 
interface;  and 

•  assign  responsibility  and  ensure  accountability. 

On  September  11,  1996,  the  Under  Secretary  of  Defense  (Comptroller)  issued  a 
memorandum  for  the  Assistant  Secretaries  or  the  MiUtary  Dq)artment5 
(Financial  Management  and  Comptroller)  and  the  Directors  of  the  Defense 
agencies.  The  memorandum  requested  that  written  agreements  document  how 
and  when  interfaces  will  be  made  Y2K  conq)liant,  and  that  progress  on 
interfaces  be  monitored  through  reviews. 

GAO  Report  No.  AIMD-97-117  (OSD  Case  No.  1392),  “Defense 
Cwnpoters:  DFAS  Faces  Cludlenges  in  Solving  the  Y2K  Problem,” 

Augi^  11, 1997.  The  r^rt  states  that  DFAS  h^  not  identified  all  system 
interfaces,  and  has  completed  only  230  of  904  written  agreements  with  interface 
partners.  After  the  report  was  issued,  DFAS  took  action  on  the  GAO  concerns. 
The  Director,  DFAS,  instructed  the  Deputy  Director  for  Information 
Management  to  establish  written  agreements  with  interface  partners  by 
September  30,  19^  (see  Appendix  B  for  details). 


Interface  Agreements  at  the  DFAS  Cleveland  Center 

Review  of  DFAS  Cleveland  Center  Interface  Agreements.  DFAS  took  action 
in  response  to  the  GAO  rqiort;  however,  as  of  November  26,  1997,  interface 
agreements  were  still  not  in  place  at  the  DFAS  Cleveland  Center.  We  selected 
9  of  76  systems  for  review.  Of  die  systems  reviewed,  DF^  identified  five  as 
being  among  its  top  20  mission-critic^  systems.  For  the  nine  systems 
reviewed,  the  DFAS  Cleveland  Center  identified  152  interfaces  with  other 
systems.  DFAS  established  79  of  the  required  interface  agreements,  but  73  had 
not  been  established.  Further,  existing  interface  agreements  for  each  of  the  9 
systems  were  inadequate. 

Existence  of  DFAS  Cleveland  Center  Interface  Agreements.  System 
managers  at  the  DF^  Cleveland  Center  have  not  established  adequate  interface 
agreements  wi^  their  partners,  despite  a  self-imposed  deadline  of 
September  30,  1997.  The  DFAS  Annual  Statement  of  Assurance  for  FY  1996 
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states  that  all  interface  agreements  will  be  established  by  S^tember  30,  1997. 
Specifically,  three  of  the  nine  systems  had  not  established  all  of  the  required 
interface  agreements.  Specifically,  of  the  top  20  mission  critical  systems: 

•  the  Standard  Accounting  and  Reporting  Systems  (STARS),  a 
migratory  system  did  not  have  48  of  the  53  interface  agreements 
needed. 

•  the  Defense  Retiree  and  Annuitjmt  Pay  System  (DRAS),  a  migratory 
system  did  not  have  8  of  the  IS  interface  agreements  ne^ed. 

•  the  DWAS,  did  not  have  17  of  the  20  interface  agreements  needed. 

Note:  Amounts  identified  in  this  report  va^  slightly  from  those  identified  in 
Appendix  C  as  a  result  of  additional  analysis  performed  since  the  memorandum 
was  issued. 

Etpments  of  Interface  Agreements.  System  managers  provided  written 
documentation  for  interface  agreements.  However,  nearly  all  agreements  l^ked 
basic  information  needed  to  inqilement  and  manage  the  interfaces.  According  to 
the  DoD  Y2K  Management  Plan  and  DFAS  guidance,  interfEu:e  agreements 
should  include  strategies  and  changed  record  formats,  milestones,  test  files  and 
affected  fields,  and  POCs  for  each  system  and  interface. 

•  Strat^es  and  Changed  RecoM  Formats.  Strategies  and  changed 
record  formats  allow  system  managers  to  identify  the  method  selected  by 
interface  partners  and  inform  management  as  to  whidi  systems  need  to  establish 
a  bridge  or  filter  to  accommodate  the  exchange  of  data.  Of  the  79  interface 
agreements  reviewed,  54  did  not  identify  either  a  strategy,  a  changed  record 
format,  or  both  (see  Appendix  C  for  a  list  of  systems  and  missing  elements). 

•  Milestones.  Interface  agreements  should  include  milestones  for 
analysis,  programming,  testing,  and  implementation  for  both  systems  to  ensure 
that  each  system  and  interface  will  meet  its  target  date  for  Y2K  compliance.  Of 
the  79  interfaces  agreements,  53  lacked  milestones.  For  exan^)le: 

•  the  Industrial  Fund  Accounting  System  (IFAS),  a  migratory 
system  that  is  also  a  DFAS  tc^  20  mission-critical  system, 
lacked  milestones  for  9  of  the  11  interface  agreements. 

•  the  ADS,  a  DFAS  top  20  mission-critical  system,  had  not 
complet^  milestones  for  12  of  13  interface  agreements. 

•  the  Uniform  Microcomputer  Disbursing  System  (UMIDS)  did 
not  have  all  milestones  for  four  of  six  interface  agreements 
(see  ^pendix  C  for  a  list  of  systems  and  missing  elements). 

•  Test  Files  and  Affected  Fields.  Test  files  and  affected  fields  allow 
program  managers  to  identify  which  files  should  be  scheduled  for  testing  so  that 
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Y2K  changes  related  to  system  interfaces  can  be  tested.  Of  the  interface 
agreements  reviewed,  51  of  79  did  not  identify  test  files,  a^ected  fields,  or 
both.  For  example: 

•  IFAS  had  not  identified  test  files  or  affected  fields  for  any  of 
the  11  interface  agreements. 

•  STARS  had  not  identified  test  files  or  affected  fields  for  four 
of  five  interface  ^eements  (see  Appendix  C  for  a  list  of 
systems  and  missing  elements). 

•  Points  of  Contact.  Identifying  a  POC  for  each  system  is  necessary 
to  clearly  outline  responsibilities  for  coordination  and  prt^r  reporting  between 
systems  and  interface  partners.  Of  the  interface  agreements  reviewed,  62  of  79 
had  not  identMed  a  POC  for  one  or  both  systems.  For  example,  ADS  had  not 
identifled  a  POC  for  1  or  both  systems  for  all  13  interface  agreements  (see 
Appendix  C  for  a  list  of  systems  and  missing  elements). 

DFAS  Efforts  to  Address  Y2K  Issnes.  On  October  31,  1997,  we  briefed 
managers  of  the  DFAS  Cleveland  Center.  On  November  17,  1997,  we  briefed 
managers  at  Headquarters,  DFAS.  On  November  26,  1997,  we  provic^ 

DFAS  management  with  a  memorandum  detailing  our  concerns  rfiout  interface 
agreements  (see  Appendix  C).  DFAS  management  held  a  Y2K  summit  on 
December  15,  1997,  with  DFAS  Center  Directors  and  Y2K  POCs.  During  the 
summit,  the  Director,  DFAS  agreed  with  the  Inspector  General  (IG),  DoD,  that 
interface  agreements  were  nonexistent  or  inadeq^te  at  all  DFAS  Centers.  He 
emphasized  ^e  need  to  quickly  obtain  adequate  interface  agreements.  DFAS 
man^ement  set  January  31,  1998,  as  the  new  deadline  for  system  managers  to 
obtain  adequate  interface  agreements.  In  response  to  our  list  of  concerns  about 
interface  agreements,  DF^  has  taken  the  following  steps. 

•  DFAS  Cleveland  Center  management  reissued  the  guidance  on 
interface  j^eements  and  directed  all  system  managers  to  review, 
rq>ort  on,  and  complete  all  Y2K  interface  agreements  by 
January  31,  1998,  and  to  immediately  report  any  problems. 

•  DFAS  Cleveland  Center  management  performed  a  spot  check  of 
interface  agreements  for  content. 

Verification  Process.  We  commend  DFAS  for  recognizing  and  addressing  the 
n^  to  develop  interface  agreements  quickly  and  for  setting  an  early  deadline. 
Ensuring  that  interface  agreements  widi  all  die  necessary  elements  are 
established  reduces  the  risk  of  errors  during  critical  data  exchanges. 

Establishing  a  process  for  verifying  interface  agreements  and  milestones  for 
completing  the  verification  process  will  help  the  Director,  DFAS  Cleveland 
^nter,  r^uce  the  risk  of  system  failures. 
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Summary 

The  DoD  Y2K  Management  Plan  provides  overall  guidance  for  DoD  Y2K 
efforts.  The  DoD  Y2K  Management  Plan  states  that  DoD  Component  heads  or 
their  Y2K  POCs  shall  document  and  obtain  interface  agreements  in  the  form  of 
MOAs  or  the  equivalent.  The  DFAS  Executive  Plan  for  Y2K  makes  system 
managers  responsible  for  obtain!^  interface  agreements  that  state  how  and 
when  the  interface  will  be  compliant.  DFAS  Cleveland  Center  management  has 
not  sufficiently  implemented  the  guidance  on  interface  agreements  and  has  not 
established  a  process  to  verily  that  all  interface  agreements  are  adequate  and  in 
place.  Thus,  the  DoD  Y2K  Management  Plan  and  the  DFAS  Executive  Plan 
for  Y2K  have  not  been  fully  implemented.  Obtaimng  interface  agreements  to 
address  the  Y2K  problem  are  critical  for  automated  financial  systems.  The 
agreements  describe  the  method  of  interface,  identify  responsibUiti^  for 
accommodating  data  exchange,  and  include  target  dates  for  each  milestone. 
Although  the  establishment  of  interface  agreements  is  imimrtant,  the  terms  and 
conditions  of  interfu^  agreements  are  more  critical,  considering  the  impact  of 
Y2K  issues.  DFAS  management  must  insist  that  system  mailers  obtain 
interface  agreements,  and  system  managers  must  be  responsible  for  reviewing 
all  interface  agreements  to  ensure  that  ev^  element  is  adequately  addressed. 
We  commend  DFAS  management  for  acting  promptly  after  our  briefing  on 
November  17,  IW,  and  our  memorandum  of  November  26,  1997  (see 
Appendix  C). 


Recommendatioiis  and  Management  Comments 

B.  We  recomm^d  that  the  Director,  Defense  Finance  and  Accounting 
Service  Qeveland  Center: 

1.  Establish  a  milestone  for  verification. 

2.  Perform  the  verification  process  to  ensure  that  all  interface 
agreements  are  complete  and  hidude  the  necessary  elements. 

Management  Comments.  The  Defense  Finance  and  Accounting  Service 
concurred,  stating  that  the  DFAS  Cleveland  Center  established  a  milestone  of 
March  31, 1998,  to  correct  deficiencies  identified  with  Year  2000  interface 
^eements.  System  managers  will  verify  that  existing  interface  agreements 
include  the  necessary  elements. 
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Appendix  A.  Audit  Process 


Scope  and  Methodology 

Work  Perfonned.  This  is  one  in  a  series  of  rqwrts  being  issued  by  the  IG, 
DoD,  in  an  informal  partnership  with  the  Chief  Information  Officer,  DoD,  to 
monitor  DoD  efforts  to  address  the  Y2K  computing  challenge.  For  a  listing  of 
audit  projects  addressing  this  issue,  see  the  y2K  World  Wide  Web  page  on  the 
IGNET  Oiittp://www.ignet.govO. 

This  report  was  based  on  audit  field  work  performed  at  the  DFAS  Cleveland 
Center  and  its  Financial  Systems  Activity  from  April  through 
December  1997. 

We  reviewed  the  DFAS  Cleveland  Center’s  quarterly  Y2K  report,  submitted  in 
October  1997  to  the  DFAS  Deputy  Director  for  Information  Management. 

Based  on  &e  DoD  Y2K  Mtmagement  Plan  and  DFAS  Regulation  8000. 1-R,  we 
evaluated  the  reliability  of  the  rq>ort.  We  also  evaluated  the  usefulness  of 
information  in  the  quarterly  report  for  oversight  purposes. 

We  interviewed  personnel  in  the  Office  of  the  ASD  (C3I)  who  issue  guidance 
on  Y2K  reporting,  collect  Y2K  information  from  the  DoD  Components,  and 
submit  the  information  to  0MB.  We  also  interviewed  DFAS  personnel  who  are 
responsible  for  Y2K  quarterly  reports.  We  interviewed  the  DFAS  Y2K  project 
manager;  the  Director,  DFAS  Cleveland  Center;  the  Y2K  POC  at  the  DFAS 
Cleveland  Center;  and  system  managers  in  functional  and  technical  areas. 

•  We  reviewed  14  of  76  systems  rq)orted  on  by  the  DFAS  Cleveland  Center.  To 
select  the  systems  for  review,  we  used  the  October  1997  DFAS  quarterly 
reports,  the  DIST  database,  and  the  DFAS  System  Inventory  Database.  Of  the 
14  systems  we  reviewed,  2  systems  were  categorized  as  compliant,  6  were  to  be 
changed  and  in  ^e  renovation  phase,  1  was  in  develf^ment,  and  S  were  to  be 
replaced.  We  reviewed  system-level  Y2K  project  pla^  and  evaluated 
documentation  to  determine  whether  the  systems  met  the  requirements  of  the 
DoD  Y2K  Management  Plan,  Version  1.0,  April  1997. 

We  selected  9  out  of  76  DFAS  Cleveland  Center  systems  to  review  their 
interface  agreements.  For  die  9  systems  reviewed,  we  requested  152  interface 
agreements  and  received  79  agreements  to  validate  their  existence  and  determine 
their  adequacy. 

Use  of  Computer-Processed  Data.  We  did  not  use  computer-processed  data  or 
statistical  sampling  procedures  to  perform  this  audit. 
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Use  of  Technical  Assistance.  We  met  with  technical  e::^erts  in  the  Analysis, 
Planning,  and  Technical  Support  Directorate  to  discuss  issues  relating  to 
interface  agreements,  testing  plans,  and  software  development  and  maintenance. 

Audit  Type,  Dates,  and  Standards.  We  performed  this  fi^cial-related  audit 
from  April  through  December  1997  in  accordance  with  auditing  standards  issued 
by  the  Comptroller  General  of  the  United  States,  as  implement^  by 
the  IG,  DoD. 

Contacts  During  the  Audit.  We  visited  or  contacted  individuals  and 
organizations  within  DoD.  Further  details  are  available  on  request. 


Management  Control  Program 

We  did  not  review  the  management  control  program  because  DFAS  and  DoD 
identified  Y2K  as  an  uncorrected  material  weakness  in  their  Annual  Statements 
of  Assurance  for  FYs  1996  and  1997. 
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The  GAO  and  the  IG,  DoD  have  conducted  multiple  reviews  related  to  Y2K  issues. 
GAO  reports  can  be  accessed  over  the  Internet  at  ht^://www.gao.goy.  IG,  DoD 
reports  can  be  accessed  over  the  Internet  at  htq)://www.dodig.osd.mil. 

General  Accounting  Office 


The  General  Accounting  Office  audit  relevant  to  this  report  is  summarized 
below. 

GAO  Report  No.  AIMD-97-117  (OSD  Case  No.  1352),  “Defense 
Computers:  Defense  Finance  and  Accounting  Service  Faces  Challenges  in 
Solving  Ae  Y2K  Problems,”  August  11, 1997.  The  report  states  that  DFAS 
developed  a  Y2K  strategy  consistent  with  the  DoD  Y2K  Management  Plan  and 
detinra  conditions  that  automated  information  systems  must  meet  to  obtain 
certification  as  Y2K  compliant.  However,  DFAS  had  not  identified  all  critical 
tasks  for  achieving  Y2K  objectives,  established  milestones  for  completing  all 
tasks,  performed  formal  risk  assessments  of  all  systems  to  be  renovated,  or 
prepared  contingency  plans  in  tiie  event  that  renovations  are  not  completed  in 
time  or  fail  to  operate  properly.  Tlie  report  also  states  that  DFAS  had  not 
identified  all  system  interfaces  and  had  completed  only  230  of  904  written 
agreements  with  interface  paitners.  Further,  DFAS  had  not  adequately  ensured 
that  testing  resources  would  be  available  to  determine  whether  all  operational 
systems  are  compliant  before  die  Y2K.  The  report  recommended  that  DFAS 
identify  Y2K  program  actions  and  milestones,  issue  guidance  on  ensuring 
continuity  of  operations,  identify  external  interfaces  and  obtain  written 
agreements  Scribing  the  metiiod  of  data  exchange,  and  devise  a  testing 
schedule  to  ensure  that  all  systems  can  operate  in  a  Y2K  environment.  The 
Under  Secretary  of  Defense  (Comptroller)  concurred  with  the  recommendations. 
DFAS  agreed  to  update  its  existing  Y2K  &eecutive  Plan  and  its  Corporate 
Contingency  Plan.  DFAS  also  agreed  to  have  all  written  interface  a^eements 
with  interface  partners  in  place  by  September  30,  1997,  and  to  fully  implement 
its  Y2K  cer^cation  process  for  ensuring  that  all  systems  are  compliant. 

Further,  DFAS  agreed  to  devise  a  testing  schedule  that  identifies  &e  test 
facilities  and  resources  needed  for  performing  proper  testing  of  its  systems  in  a 
Y2K  environment. 
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IMSPECTOR  GENERAL 

OF  OCFENSE 
400  army  NAVY  KMMi 
AAUNCrrON.  Vff«2MA  22202 


November  26,  1997 


MEMORANDUM  FOR  DEPUTY  DIRECTOR  FOR  INFORMATION  MANAGEMENT, 
DEFENSE  FINANCE  AND  ACCOUNTING  SERVICE 

SUBJECT:  Review  of  Defense  Finance  and  Accounting  Service  (DFAS)  Year  2000 
Initiatives 


Our  review  of  the  DFAS  Year  2000  Initiatives  was  based  on  survey  and  audit  field  work 
performed  at  the  DFAS  Indianapolis  and  Oeveland  Centers  and  Financial  Systems  Activiues 
from  August  through  October  1997.  This  memorandum  reports  the  initial  results  of  our  review . 
We  used  guidance  conuined  in  the  DoD  Year  2000  Manag^nt  Plan.  Version  1 .0  April  1997 
to  evaluate  the  overall  effectiveness  of  DFAS  Year  2000  efforts.  The  review  also  considered 
and  evaluated  the  use  of  DFAS  regulations  and  industry's  best  practioes.  as  needed. 

We  held  an  In  Process  Review  with  Mr.  Amlin,  Acting  Director,  DFAS  on 
November  17,  1997.  During  this  In  Process  Review,  we  briefed  prelimlnafy  issues  concerning 
interface  agreements  and  the  accuracy  of  quarterly  reports.  Per  your  request,  we  have  drafted 
an  assessment  of  the  quarterly  reports  and  status  of  Interface  agreements. 

D\ie  to  the  nature  of  Year  2000  efforts,  it  is  our  intent  to  identify  potential  areas  of 
concern  so  that  DFAS  Management  may  address  these  issues  in  a  dinely  manner.  We  may 
include  these  and  any  additional  issues  in  a  draft  report  at  a  later  date.  If  there  are  any 
questions,  please  contact  Mr.  Geoffrey  Weber.  Acting  Project  Manager,  at  (703)  604-9151  or 
DSN  664-9151  or  Ms.  Kimberly  C^o  (703)  604-9139  DSN  664-9139. 


— 

F.  Jay  Lane 
Direaor 

Finance  and  Accounting  Directorate 
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Interface  Am-eements 

According  to  the  DoD  Year  2000  Management  Plan,  data  exchanges  are  critical  in  the 
Year  2000  effort  because  they  have  the  potential  to  introduce/propagate  errors  from  one 
organization  to  another.  Trading  partners  can  help  mitigate  this  j^tential  pitfall  by 
agreeing  early  on  to  schedules,  changed  record  formats,  and  by  providing  one  another 
with  test  files.  On  September  11,  1996,  the  Deputy  Secretary  of  Defense  issued  a 
memorandum  for  the  Assistant  Secretaries  of  The  Military  Departments  (Financial 
Management  and  Comptroller),  and  the  Directors  of  The  Defense  Agencies.  In  his 
memorandum,  the  Deputy  Secretary  requested  that  written  agreements  document  how 
and  when  interfaces  will  be  made  Year  2000  compliant,  and  that  a  process  be 
established  to  monitor  progress.  We  believe  that  it  is  imperative  for  systems  to  have 
adequate  interface  agreements  in  place  for  each  interface. 

For  an  interface  agreement  to  be  adequate,  some  of  the  major  elements  that  should  be 
addressed  and  included  in  written  interface  agreements  are  milestones,  strategies  and 
change  record  formats,  identified  test  files  aid  affected  fields,  and  a  point  of  contact 
for  each  system.  Milestones  should  be  included  m  the  interface  agreements  to  help 
ensure  that  each  system  and  interface  will  meet  their  target  date  for  implementation. 
Documenting  the  strategies  and  record  change  formats  enable  systems  to  iden^  the 
interfacing  Ses  and  the  strategy  selected  by  interface  partners.  This  information  will 
allow  for  the  establishment  of  bridges  or  filters,  as  needed.  Test  fries  and  affected 
fields  will  identify  which  fries  should  be  scheduled  for  testing  so  that  Year  2000 
changes  related  to  system  interfaces  can  be  prc^erly  tested.  A  documented  point  of 
contact  (PCX!)  for  each  system  will  ensure  that  full  coordination  and  proper  reporting 
progress  is  facilitated  between  systems  and  interface  partners. 

The  following  conclusions  are  based  on  self-identified  interfaces  and  written  interface 
agreements  provided  to  our  office  during  our  visit  to  the  DFAS  Cleveland  Center 
during  the  period  Oct.  27-31 ,  1997.  Our  office  requested  and  reviewed  interface 
agreements  from  9  systems  at  the  DFAS  Cleveland  Center.  We  found  that  some 
interface  agreements  had  not  yet  been  established  and  that  some  lacked  sufficient  detail. 
We  only  noted  the  missing  or  inadequate  critical  elements  that  require  attention. 

Interface  Agreements: 

Standard  Accounting  and  Reporting  System  (STARS) 

Migratory  and  DFAS  Top  20  Critic^  This  system  has  identifred  55  interfaces.  Over 
90  percent  of  the  interface  agreements  are  not  in  place  (50  out  of  55). 

Defense  Retiree  and  Annuitant  Pay  System  (DRAS) 

Migratory  and  DFAS  Top  20  Critical  This  system  has  identifred  15  interfaces.  Over 
53  percent  of  the  interface  agreements  are  not  in  place  (7  out  of  15). _ 
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Defense  Working  Capital  Accounting  System  (DWAS) 

Migratory  and  Mission  Critical  This  system  has  identified  20  interfaces,  over  85 
percent  are  not  in  place  (17  out  of  20). 

Msgor  Elements  of  interface  Agreements: 

Milestones: 

Automated  Disbursing  System  (ADS) 

DFAS  Top  20  Critical  12  of  the  13  interface  agreements  did  not  identify  milestones. 
Industrial  Fund  Accounting  System  (IFAS) 

hDgratory  and  DFAS  Top  20  Critical  8  of  the  10  interface  agreements  did  not  have 
milestones,  or  only  identified  partial  milestones. 

Uniform  Microcomputer  Disbursing  System  (UMIDS) 

DFAS  Top  20  Critical  S  of  the  6  interface  agreements  did  not  have  milestones,  or 
only  identified  partial  milestones. 

Strategies  and  change  record  formats: 

Departmental  Financial  Reporting  &  Reconciliation  System  (DFRRS) 

13  of  the  26  interface  agreements  failed  to  identify  the  strategy  to  be  used  and/or  failed 
to  describe  or  assign  responsibility  for  a  bridge. 

Test  files  and  afiected  fields: 

Automated  Disbursing  System  (ADS) 

DFAS  Top  20  Critical  11  of  die  13  interface  agreements  failed  to  identify  test  files. 
Of  these  11,  one  mentioned  test  files  but  failed  to  identify  affected  fields. 

Industrial  Fund  Accounting  System  (IFAS) 

Migratory  and  DFAS  Top  20  Critical  None  of  IFAS’s  interface  agreements 
identified  test  files  or  affected  fields. 

Departmental  Financial  Reporting  &  Reconciliation  System  (DI’RRS) 

Critical  16  of  the  26  interfaces  agreements  failed  to  identify  their  test  files  and 
affected  fields. 
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Standard  Accounting  and  Reporting  System  (STARS) 

Migratory  and  DFAS  Top  20  Critic^  4  f  the  5  interface  agreements  failed  to  identify 
test  tiles  and  affected  fields. 

Point  of  Contact  (POC): 

Of  the  149  interface  agreements  reviewed,  only  10  interfaces  identitied  a  POC  with 
both  a  name  and  phone  number  for  each  system. 


The  DoD  Year  2000  Management  Plan  has  established  certain  reporting  guidelines  to 
standardize  the  rq>orting  process  and  to  ensure  that  a  consistent  methodology  is 
followed  by  system  managers  when  reporting  the  Year  2000  status  of  systems.  We  are 
concerned  about  the  level  of  work  that  is  implied  when  systems  are  rqiorted  in  a 
particular  phase  of  the  quarterly  report.  Wlule  the  accuracy  of  reporting  is  aritical,  we 
have  an  equal  concern  about  the  actual  work  that  has  been  performed  to  date. 

We  selected  systems  from  the  DFAS  Indianapolis  and  DFAS  Cleveland  Centers  that 
were  included  in  the  DFAS  quarterly  reports.  We  reviewed  systems  that  were  reported 
in  the  renovation  phase  or  compliant  category.  We  interview^  system  functional  and 
technical  managers  and  reviewed  sui)porting  documentation  to  determine  whether  the 
systems  met  the  minimum  exit  mteria  r^irements  outlined  in  the  DoD  Year  2000 
Management  Plan,  vision  1 .0  April  1997.  In  analyzing  the  systems,  we  did  not 
consider  the  conti^ency  strategy  and  risk  management  strategy  to  determine  if  a 
system  was  categorized  in  the  correct  phase.  We  used  the  October,  1997  DFAS 
quarterly  report  to  select  the  DFAS  Cleveland  Center  systems  and  the  July,  1997 
DFAS  quarterly  report  to  select  DFAS  Indianapolis  Center  systems.  Our  concerns  are 
outlined  below  by  DFAS  Center  and  system. 

DFAS  Qeveland  Center  Systems 

Automated  Disbursing  System  (ADS): 

Migrate^  and  DFAS  Top  20  CrMcal  Syston 

The  requirement  to  identify  the  resource  strategy  requirements  as  well  as  the 
requirement  to  document  die  start  and  release  ^te  for  each  phase  was  met.  However, 
the  renovation  strategy,  validation  strategy  and  the  major  steps  to  establish  the 
necessary  infrastructure  requirements  were  not  established.  Hie  Y2K  plan  was 
madequate  and  system  manners  stated  there  was  no  documentation  to  support  the  work 
performed  during  the  assessment  phase.  ADS  was  reported  in  the  rmiovation  phase 
in  the  DFAS  October  quarterfy  report.  However,  the  system  had  not  met  the 
minimum  exit  criteria  and  should  have  been  reported  in  the  assessment  phase. 
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Book  Entry  Bond  System  (BEBS): 

The  requirement  to  establish  the  start  and  release  date  for  each  phase  was  met.  System 
managers  had  not  established  the  renovation  strategy,  validation  strategy  and  the  major 
steps  to  identify  the  necessary  infrastructure  requirements.  Additionalljr,  the  resource 
strategy  requirement  was  not  met.  The  Y2K  plan  lacked  sufficient  detail.  Although 
system  managers  stated  that  they  were  still  performing  analysis,  the  July  quarterly 
report  reflect^  that  the  system  was  in  the  renovation  phase.  Additionally, 
documentation  provided  by  system  managers  stated  that  programming  would  begin  in 
January  1998  arid  that  analysis  would  be  completed  in  Dumber  1997.  The  sj^em 
was  reported  in  the  renovation  phase  in  the  DFAS  October  quarterly  report. 
However,  the  DoD  Year  2000  Management  Plan  minimum  exit  criteria  had  not 
been  met.  The  system  should  have  been  reported  in  the  assessment  phase. 

Standard  Accounting  and  Reporting  System  (STARS): 

Migratoi^  and  DFAS  Top  20  Critical  System 

The  reqtmement  to  identify  the  start  and  release  date  for  each  phase  and  the  major  steps 
to  establish  the  necessary  infrastructure  requirements  was  met.  The  system  mailers 
provided  information  related  to  risk  management,  environment,  hardware  technical 
descriptions,  resources,  and  responsibilities.  However,  validation  strategy  and 
renovation  strategy  requirements  had  not  been  met.  The  Y2K  plan  obtained  is  not 
sufficiently  details.  The  system  was  reported  in  the  renovation  phase  in  the  DFAS 
October  quarterfy  report.  However,  the  system  had  not  met  the  minimum  exit 
criteria  and  should  have  been  reported  in  the  assessment  phase. 

Defense  Working  Capital  Accounting  System  (DWAS): 
hHgratory  and  DFAS  Top  20  Critical  System 

Al&ougji  the  DWAS  system  is  rqported  in  the  compliant  category,  the  system 
certifications  are  still  in  process.  Certification  level  II  for  the  DAPS  component  is 
ongoing  and  Certification  level  I  for  PWC  is  due  in  March/ April  1998.  Since  the 
operating  system  is  not  compliant  and  system  management  stated  that  the  Joint 
Interoperability  Test  Command  will  perform  3rd  party  testing,  the  system  should  be 
report^  in  the  validation  phase.  The  system  was  reported  in  the  compliant  category 
in  the  DFAS  October  quarterfy  report.  However,  the  DoD  Year  2000 
Management  Plan  exit  criteria  had  not  been  met  and  the  system  should  have  been 
reported  in  the  validation  phase  and  should  not  be  listed  in  the  compliant 
category. 

Standard  Finance  System  (STANFINS): 

The  system  managers  stat^  that  the  Y2K  approach  and  strategy  had  not  yet  been 
determined  during  interviews  held  on  August  12,  1997.  A  Y2K  plan  was  anticipated  to 
be  developed  and  completed  by  October,  1997.  The  system  should  not  have  been 
categorized  in  the  renovation  phase  as  of  8/12/97  as  the  minimum  exit  criteria  for 
the  assessment  phase  had  not  been  met. 
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DEFENSE  FINANCE  AND  ACCOUNTINa  SERVICE 
CLEVELAND  CENTER 
1240  EAST  NVTTH  rTREET 
CLEVELAND.  OH  44120-3055 

JAN  1 2  1998 


MEMORANDUM  FOR  DIRECTOR.  DEFENSE  FINANCE  AND  ACCOUNTING  SERVICE, 

FINANCIAL  SYSTEMS  ORGANIZATION 

SUBJECT:  Y2K  DoDIG  Data  Request 


In  repose  to  the  Department  of  Defense,  Inspector  General  (DoDIG)  memorandum  of 
November  17. 1997  concerning  the  Year  2000  (Y2K)  for  the  Defense  Finance  and  Accounting 
Service  •  Geveland  Center  (DFAS-CL),  I  have  reviewed  and  concur  with  the  attached. 

My  point  of  contact  is  Richard  Krajewski  or  Sandra  Johnson.  Th^  can  be  reached  at 
DSN  580-5116/5628  or  (21 6)  522*51 1 6-5628. 


(DFAS-CL/M) 


PhyUtt  A.  Hudson 


Director 


Attachments: 
As  stated' 


dk  D.  DFAS  Cleveland  Center  Comments  on  IG,  DoD,  Memorandum 


The  following  Is  pronded  to  respond  to  the  DoDIG  request  of  1/7/98. 

Interface  Agreements  -  DFAS-CL  management  has  taken  the  foUovdng  initiatives  to 
validate  the  existence  and  adequacy  of  Y2K  interface  agreements: 

1.  DFAS-CL  management  directed  that  the  DFAS-CL  system  managers  review  all  their 
existing  Y2K  Inter&ce  AgreemeDts  (MOAs)  for  content/adequa^.  A  spreadsheet  report 
format  was  provided  for  this  rewew  on  12/22/97.  The  review  was  to  include  the 
following  items:  ^rstetns  named  vnth  Y2K  strategy,  interfkce  file(s)  listed,  nunfoer  of  input 
files,  number  of  output  files,  interface  file  layout(5}  attached  or  affected  fields  listed, 
interfiice  strategy  listed,  schedule  with  target  completion  dates  listed,  manager  names 
printed,  signed  by  both  parties,  POC  information  listed  on  attached  sheeL  The  Y2K  MOA 
review  report  is  due  back  to  the  DFAS-CL  Y2K  Project  Coordinator  by  1/20/98. 

2.  The  DFAS-CL  Director  directed  that  all  Y2K  interface  agreements  are  to  be  coir^ieted 
by  1/30/98  with  no  exceptions.  Her  direction  stated  that  any  problems  are  to  be 
forwarded  up  the  management  chain  immediately.  Any  outstanding  Y2K  MOAs  are  to  be 
forwarded  with  dates  and  times  of  discussion  and  POC  information.  The  Krector  will 
foUow  up  on  the  outstanding  MOAs  with  her  POCs  in  the  Navy  and  other  agencies  as 
required.  In  November,  the  DFAS-CL  Director  provided  the  Principal  Dqnity,  ASN 
(FM&C),  with  a  list  of  outstanding  interface  agreements  between  Navy  and  DFAS-CL. 
Y2K  status  of  agreements  is  discussed  during  thar  weddy  conference  call  and  appropriate 
follow-up  taken. 

3.  The  completed  Y2K  Interface  Agreements  ^OAs)  for  all  DFAS-CL  critical  ^ems 
were  collected  in  December  1 997.  Spot  checks  on  MOA  content  were  conducted  by  the 
DFAS-CL  Y2K  Project  Officer.  Some  system  marugers  were  contacted  to  ascertain  if 
multiple  interfiles  on  one  agreement  were  being  counted  as  one  interfoee  or  the  number 
of  files  that  were  actually  bdng  exchanged. 

4.  Guidance  on  the  required  content  of  a  Y2K  interfoce  agreement  was  rdssued  to  system 
managers  working  on  MOAs  in  December.  DFAS-CL  Director's  memorandum  oT  August 
8,  1997  provided  a  sample  format.  This  format  was  subsequently  also  posted  on  the 
DFAS  website. 


Adequate  agfi«8mient  -  The  following  actions  have  been  taken  to  ensure  the  adequacy  of 
assessments  being  conducted. 

1.  The  DFAS-CL  Director  directed  a  review  of  Y2K  plans.  The  Y2IC  ptans  of  all  DFAS-CL 
critical  systems  were  reviewed  by  the  Information  Management  Office 

(DFAS-CL/MO).  The  rmdew  was  to  ensure  that  all  system  Y2K  plans  contained  at  least  the 
mininxum  m^or  milestones  tiiat  bad  been  mandated  at  previous  Y2K  Control  Board 
meetings.  The  review  also  included  a  check  on  the  sequence  and  logic  of  dates  provided. 


29 


tndiy  D.  DFAS  Cleveland  Center  Comroentoi  on  IG.  DoD,  Memorandum 


Additionally,  our  assessment/review  process  is  considered  continuous  in  that  as  additional 
refinements/changes  are  identified  th^  are  added  to  the  plan  and  worked  accordingly. 

2.  The  DFAS-CL  Director  has  continued  vwth  monthly  Y2K  Program  Control  Board 
meetings.  She  has  used  this  forum  for  Y2K  system  status  updates  on  spectiic  systems  and 
also  to  sui&ce  Y2K  issues  and  problems.  The  meetings  are  also  used  to  provide 

information  updates  on  Y2K  from  a  DFAS  perspective. 

§ 

3.  The  DFAS  Y2K  Management  Plan,  December  1997,  has  been  distributed  via  dectronic 
mail  to  the  DFAS-CL  management  and  the  DFAS-CL  sj'siem  manager  network. 

■  Systems  Reported  as  Compliant  but  not  certified  -  The  following  actions  have  been 
taken  to  ensure  the  adequacy  of  test  plans,  test  results,  and  certifications. 

1 .  The  DFAS-CL  Y2K  Project  Officer  issued  a  message  on  Test  plans.  The  message 
indudes  what  is  e}q}ected  in  a  test  plan  and  referenced  the  rdevant  guidance  document, 
the  DFAS  Y2K  Management  Plan.  A  sample  test  supplied  by  the  t)FAS  Y2K  POC  was 
also  distributed.  Other  exan^iles  of  test  plans  were  o^ed  on  request 

2.  The  test  plans  and  test  results  for  all  DFAS-CL  critical  S3'5tems  that  have  reached  the 
st^e  when  these  documents  have  been  produced,  were  coHected  in  December  1 997  by 
DFAS-CL/MO.  A  general  review  of  the  documents  for  adequai^  was  conducted. 

» 

3.  The  procedure  that  the  DFAS-CL  has  followed  with  respect  to  Y2K  Compliance 
Certification  is  that  the  document  is  subnutted  via  the  DFAS-CL  Y2K  Project  Officer  to 
the  Director.  The  Project  Officer  reviews  the  document,  discusses  items  with  the  system 
manager  as  necessary,  and  recommends  disporitionto  Director.  The  DFAS-CL  Director 
conducts  an  interview  with  the  system  manager  and  reviews  tiie  Y2K  Compliance 
Certification  document  with  that  manager  prior  to  signing  the  document 


Sandra  Johnson 
DFAS-aY2K  ' 
Project  Coordinator 
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Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 
Deputy  Comptroller  (Program/Budget) 

Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and  Intelligence) 
Assistant  Secretary  of  Defense  (I^blic  Affairs) 

Director,  Defense  Logistics  Studies  Information  Exchange 


Department  of  the  Army 

Assistant  Secretary  of  the  Army  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Army 


Department  of  the  Navy 

Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Navy 


Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Air  Force 


Defense  Organizations 

Director,  Defense  Contract  Audit  Agency 
Director,  Defense  Finance  and  Accotmtii^  Service 
Deputy  Director  for  Information  Management 
Director,  Defense  Finance  and  Accounting  Service  Cleveland  Center 
Director,  Defense  Finance  and  Accounting  Service  Indianapolis  Center 
Director,  Defense  Logistics  Agency 
Director,  National  Security  Agency 

Inspector  General,  National  Security  Agency 
Director,  Defense  Information  Systems  Agency 
Inspector  General,  Defense  Intelligence  Agency 
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Non-Defense  Federal  Organizations  and  Individuals 

Office  of  Management  and  Budget 

Technical  Information  Center,  National  Security  and  International  Affairs  Division, 
General  Accounting  Office 

Chairman  and  ranking  minority  member  of  each  of  the  following  congressional 
committees  and  subcommittees; 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 
Senate  Committee  on  Armed  Services 
Senate  Committee  on  Governmental  Affairs 
House  Committee  on  Apprq^riations 

House  Subcommittee  on  National  Security,  Committee  on  Appropriations 
House  Committee  on  Government  Reform  and  Oversight 
House  Subcommittee  on  Government  Management,  Mormation,  and  Technology, 
Committee  on  Government  Reform  and  Oversight 
House  Subcommittee  on  National  Security,  International  Affairs,  and  Criminal 
Justice,  Committee  on  Government  Reform  and  Oversight 
House  Committee  on  National  Security 
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DEFENSE  FINANCE  AND  ACCOUNTING  SERVICE 

1931  JEFFERSON  DAVIS  HIGHWAY 
ARLINGTON,  VA  22340-9291 


DFAS-HQ/S 


March  17,  1998 


memorandum  for  inspector  general,  department  op  defense 

SUBJECT;  Audit  Report  on  Year  2000  Initiatives  at  the 

Defense  Finance  and  Accounting  Service  Cleveland 
Center  (Project  No.  7FG-0043) 

In  response  to  your  memorandum  dated  January  27,  1998, 
subject  as  above,  the  audit  report  has  been  reviewed  and  the 
attached  comments  are  provided  for  your  consideration. 

Any  questions  should  be  direct  to  the  DFAS  Year  2000  Project 
Officer,  Mrs.  Sharon  Brustad,  at  317-510^5647  (DSN  699-5647) . 


C.  Vance  Kauzlarich 

Director  for  Information  and  Technology 


Attachment;  As  stated 
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1.  Recommendation  A.l;  Direct  system  managers  at  the  Defense 
Finance  and  Accounting  Service  Cleveland  Center  to  fulfill  the 
assessment  phase  exit  criteria  in  the  DoD  Year  2000  Management 
Plan  for  systems  reported  as  being  in  the  renovation  Phase. 

DFAS  Cleveland  Response  A.l:  Concur.  System  managers  will 
be  directed  to  ensure  they  fulfill  the  assessment  phase  exit 
criteria  in  the  DoD  Year  2000  Management  Plan.  It  is  our  belief 
that  DFAS  Cleveland  met  the  minimum  assessment  phase  exit 
criteria  by  using  a  combination  of  Corporate  Level  and  System 
level  planning  and  documentation.  The  renovation  strategies  were 
determined  and  reported  on  the  DFAS  Y2K  Report.  The  DFAS 
validation  strategy  is  documented  in  the  DFAS  Regulation  8000.1- 
R.  The  DFAS  Cleveland  system  managers  did  comply  with  the 
guidance  in  the  DFAS  Year  2000  Executive  Plan  and  with  the 
guidance  provided  both  verbally  and  in  writing  by  the  DFAS  Year 
2000  Project  Officer. 

2.  Recommendation  A. 2:  Direct  system  managers  at  the  Defense 
Finance  and  Accounting  Service  Cleveland  Center  to  meet  all 
criteria  in  the  DoD  Year  2000  Management  Plan  for  systems  listed 
as  Year  2000  compliant/  including  completion  of  the  Defense 
Finance  and  Accounting  Service  compliance  certification 
checklist/  before  reporting  systems  as  compliant. 

DFAS  Cleveland  Response  A. 2;  Concur.  DFAS  systems  were 
placed  in  the  compliant  category  before  the  certification  process 
was  required.  All  of  the  DFAS  Cleveland  systems  currently  listed 
in  the  compliant  category  have  been  certified.  System  managers 
will  complete  the  Defense  Finance  and  Accounting  Service 
compliance  certification  checklist  before  reporting  systems  as 
compliant. 

3.  Recommendation  A. 3;  Establish  a  verification  mechanism  to 
ensure  that  systems  are  progressing  as  needed  to  meet  the 
deadline  and  that  information  reported  to  DoD  and  Defense  Finance 
and  Accounting  Service  management  is  accurate/  reliable,  and 
reflects  the  status  of  each  Defense  Finance  and  Accounting 
Service  system. 

DFAS  Cleveland  Response  A. 3;  Concur.  The  DFAS  Cleveland 
Director  will  address  the  systems'  status  at  the  DFAS  Cleveland 
Y2K  Control  Board  meetings  which  are  held  monthly.  This  forum  is 
used  by  the  DFAS  Cleveland  Director  to  obtain  detailed  Year  2000 
status  updates  on  selected  systems/  to  monitor  progress  on  Y2K 
projects,  to  surface  outstanding  issues  and  concerns  related  to 
Y2K  on  any  system,  and  to  ensure  that  corrective  actions  are 
taken  when  problems  arise. 


Attachment  1 


4.  Recommendation  B . 1 :  Establish  a  milestone  for  verification. 

DFAS  Cleveland  Response  B.l;  Concur.  Verification  and 
correction  of  deficiencies  identified  with  Year  2000  interface 
agreements  should  be  completed  on  March  31/  1998. 

5.  Recommendation  B.2;  Perform  the  verification  process  to 
ensure  that  all  interface  agreements  are  complete  and  include  the 
necessary  elements. 

DFAS  Cleveland  Response  B,2;  Concur.  DFAS  Cleveland 
management  directed  that  the  DFAS  Cleveland  system  managers 
review  all  existing  Year  2000  interface  agreements  for 
content /adequacy.  The  review  includes:  systems  named  with  Y2K 
strategy/  interface  file(s)  listed,  number  of  input  files/  number 
of  output  files,  interface  file  layout (s)  attached  or  affected 
fields  listed/  interface  strategy  listed/  schedule  with  target 
completion  dates  listed/  manager  names  printed/  signed  by  both 
parties,  and  POC  information  listed  on  attached  sheet. 


Attichment  I 
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Audit  Team  Members 


The  Finance  and  Accounting  Directorate,  Office  of  the  Assistant  Inspector 
General  for  Auditing,  DoD,  produced  this  report. 


F.  Jay  Lane 
Salvatore  D.  Guli 
Kimberley  A.  C^rio 
Geoffrey  L.  Weber 
Phillip  L.  Holbrook 
Anthony  L.  Carbone 
A.  Dahnelle  Alexander 
Bryan  K.  Kitchens 
Velma  E.  Garcia-White 
Susanne  B.  Allen 
Harriet  E.  Lambert 
Traci  Y.  Sadler 


